Openswan Installation And Configuration Tutorial

OPENSWAN INSTALLATION AND CONFIGURATION TUTORIAL Requirements To configure a network-to-network (host-to-host) connection it is necessary to have: Two Linux gateways; Openswan and ipsec-tools installed on both gateways; The two machines should either be behind the "same" NAT or have public routable IP addresses, with no firewalls.

Gather information For each gateway, it is necessary to compile the following information: Gateway IP; A name by which gateway can identify itself for IPsec negotiations. Its form is a Fully Qualified Domain Name preceded by an @ sign, i.e. @example.com. NOTE: It does not need to be within a domain that is owned. It can be a made-up name.

Openswan implementation scheme.

Installation/Configuration Step-by-Step Install Openswan To install Openswan it is necessary to run on the terminal of each machine the following command: # apt-get install openswan ipsec-tools Start Openswan To start the IPsec session it is necessary to perform, on both machines, the following command: # service ipsec start

saulparada

1

Get the leftrsasigkey On the local Linux Openswan gateway, print the IPsec public key: # ipsec showhostkey --left The output should look similar to: # RSA 2048 bits server.com Mon Feb 23 14:50:57 2009 leftrsasigkey=0sAQPGl/wJ+AMpDehHdRjs0vZRWRig5Gu4nPrfh9OLkojJwznGRlO/qCWVK32Oy5CnyMG5t z1knruOW8FSff4utWoYGc+tmnQM15h593M2/BU3ubNlV/kIOHhs4eGNzDNODxxCYCIv4w4HBHrfQLodqG 9EOrGmb02AfuTrmxjgSQM/ci2G91k5QVdSWDvFyl+UB/U2LRohTLtZi9nbDCYf7eud9BXJHxi2BTqjLM61as+ 871tT04vMbDr4NaFX83NuxOtUYgFsxw7jy5aHRiYD+3z4UCdZeG6p2pPibHx4TqfluiT582TIEfh69JCPc8JUtz kkjt0TtHrsuTGbFsn/n1wl If there are not any key or it shows nothing, it is necessary to do: # ipsec newhostkey --output /etc/ipsec.secret --bits 2048 --hostname server.com Get the rightrsasigkey On the console at the remote side it is necessary to type: # ipsec showhostkey --right It should show something like: # RSA 2048 bits client.com Mon Feb 23 15:05:14 2009 rightrsasigkey=0sAQPpWAI3RsIGnpnjshI2HGq46iN0htpEl5YQ3BsM/rfUUnQuCi1LruE2wmDzDGpGxzwsW q7gkhgWsT7G7I75uxxk4MfBAHPIhrUsxYTmTOU+YKnPiWXPFYnllysYqyQsoqav/6s07kkCBzgRmgkSjqv1eV CwmJaLD8vj7jQkxocFa8dRT8lRItnwEIjBBwp7j8KiBgRU6ivNdDrYxAuU0Mq5LW+hkCEbaUP0CMOj0TNcVu qRDCKHqO+HkNVCOPPg+TaDWE8Eb26j8FvNCu/ero4vTYK57aHq/8g/3LMcqqzsZH2bneyjVe6+gsOJLyzV7 ktAXPgFh+ObkdacxtNdlcIL Edit /etc/ipsec.conf Back on the local gateway, it is necessary to edit the template "/etc/ipsec.conf" and substitute the information for the gathered data. # /etc/ipsec.conf - Openswan IPsec configuration file # RCSID $Id: ipsec.conf.in,v 1.15.2.6 2006/10/19 03:49:46 paul Exp $ # This file: /usr/share/doc/openswan/ipsec.conf-sample # # Manual: ipsec.conf.5

saulparada

2

version 2.0

# conforms to second version of ipsec.conf specification

# basic configuration config setup # plutodebug / klipsdebug = "all", "none" or a combation from below: # "raw crypt parsing emitting control klips pfkey natt x509 private" # eg: plutodebug="control parsing" # # ONLY enable plutodebug=all or klipsdebug=all if you are a developer !! # # NAT-TRAVERSAL support, see README.NAT-Traversal nat_traversal=yes # virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12 # # enable this if you see "failed to find any available worker" nhelpers=0 # Add connections here # sample VPN connections, see /etc/ipsec.d/examples/ #Disable Opportunistic Encryption include /etc/ipsec.d/examples/no_oe.conf conn host-to-host left=158.196.81.208 leftsubnet=158.196.81.0/24 [email protected]

# Local IP address # Local netmask #

leftrsasigkey=0sAQPGl/wJ+AMpDehHdRjs0vZRWRig5Gu4nPrfh9OLkojJwznGRlO/qCWVK32Oy5CnyMG5t z1knruOW8FSff4utWoYGc+tmnQM15h593M2/BU3ubNlV/kIOHhs4eGNzDNODxxCYCIv4w4HBHrfQLodqG 9EOrGmb02AfuTrmxjgSQM/ci2G91k5QVdSWDvFyl+UB/U2LRohTLtZi9nbDCYf7eud9BXJHxi2BTqjLM61as+ 871tT04vMbDr4NaFX83NuxOtUYgFsxw7jy5aHRiYD+3z4UCdZeG6p2pPibHx4TqfluiT582TIEfh69JCPc8JUtz kkjt0TtHrsuTGbFsn/n1wl leftnexthop=%defaultroute # Correct in many situations right=147.32.201.116 # Remote IP address rightsubnet=147.32.201.0/24 # Local netmask [email protected] # rightrsasigkey=0sAQPpWAI3RsIGnpnjshI2HGq46iN0htpEl5YQ3BsM/rfUUnQuCi1LruE2wmDzDGpGxzwsW q7gkhgWsT7G7I75uxxk4MfBAHPIhrUsxYTmTOU+YKnPiWXPFYnllysYqyQsoqav/6s07kkCBzgRmgkSjqv1eV CwmJaLD8vj7jQkxocFa8dRT8lRItnwEIjBBwp7j8KiBgRU6ivNdDrYxAuU0Mq5LW+hkCEbaUP0CMOj0TNcVu qRDCKHqO+HkNVCOPPg+TaDWE8Eb26j8FvNCu/ero4vTYK57aHq/8g/3LMcqqzsZH2bneyjVe6+gsOJLyzV7 ktAXPgFh+ObkdacxtNdlcIL rightnexthop=%defaultroute # Correct in many situations ike=aes128 # IKE algorithms (AES cipher) esp=aes128 # ESP algorithns (AES cipher) #ike=3des # IKE algorithms (3DES cipher)

saulparada

3

#esp=3des auto=start auth=ah

# ESP algorithns (3DES cipher) # enables the connection at startup #

# Lines starting with # will not be read by Openswan (ipsec-tools) NOTE: "Left" and "right" should represent the machines that have Openswan installed on them.

Must be copied the "conn host-to-host" to the remote-side "/etc/ipsec.conf". It can be done with a flash disk or by other ways. Define Gateways: # route add default gw IP_ADDRESS NOTE: It is necessary define as default gateway the IP of each machine. Restart Openswan at both sides: # /etc/init.d/ipsec restart Start the connection Locally, it is necessary to type: # ipsec auto --up host-to-host It should be seen: 104 "host-to-host" #1: STATE_MAIN_I1: initiate 003 "host-to-host" #1: ignoring unknown Vendor ID payload [4f45606c50487c5662707575] 003 "host-to-host" #1: received Vendor ID payload [Dead Peer Detection] 003 "host-to-host" #1: received Vendor ID payload [RFC 3947] method set to=110 106 "host-to-host" #1: STATE_MAIN_I2: sent MI2, expecting MR2 003 "host-to-host" #1: NAT-Traversal: Result using RFC 3947 (NAT-Traversal): no NAT detected 108 "host-to-host" #1: STATE_MAIN_I3: sent MI3, expecting MR3 004 "host-to-host" #1: STATE_MAIN_I4: ISAKMP SA established {auth=OAKLEY_RSA_SIG cipher=aes_128 prf=oakley_md5 group=modp1536} 117 "host-to-host" #2: STATE_QUICK_I1: initiate 004 "host-to-host" #2: STATE_QUICK_I2: sent QI2, IPsec SA established {ESP=>0x8152a629 <0xfe7de2f9 xfrm=AES_128-HMAC_MD5 NATD=none DPD=none} NOTE: The SPI# is logged, vendors IDs are logged and the cryptographic parameters are also logged. The new tunnel protects only net-net traffic, not gateway-gateway, or gateway-subnet.

saulparada

4

Commands Openswan can be started, stopped or restarted after booting using the following ipsec initialization scripts: # service ipsec start # service ipsec stop # service ipsec restart

Sources: http://wiki.openswan.org/index.php/Openswan/Configure Openswan: Building and Integrating Virtual Private Networks: Learn from the developers of Openswan how to build industry standard, military grade VPNs ... with Windows, MacOSX, and other VPN vendors by Paul Wouters

saulparada

5